To mitigate the impact of an emergency, like the COVID-19 pandemic, on businesses, workers, customers, communities, and the general public, employers need to plan. That process may involve updates to existing plans related to specific, identifiable dangers or risks. In the case of a pandemic, that may require information from infectious disease experts. In other cases, knowledge of severe weather, cyberthreats, disaster, and other threats is important.
Employers or communities who have not prepared for an emergency or disaster should prepare themselves and their workers as far in advance as possible to avoid worsening the effects of the emergency. Lack of continuity planning can result in a cascade of failures as employers or communities attempt to address challenges with insufficient resources and workers perform jobs they might not be adequately trained for under less-than-ideal conditions.
This guidance is intended for planning purposes. Employers, communities, and workers should use this planning guidance to help identify risk levels in workplace settings and to determine any appropriate control measures to implement. Additional guidance may be needed.
The operations of an organization or a community are essentially its core activities. It is important to document these key functions and processes critical to the survival and ongoing vitality of your organization.
Production, sales, service delivery, communications, accounting, and research are just a few examples of key functions or departments. Listing and acknowledging the importance of these anchors will keep your organization or community running smoothly and maximize its success.
Organizational recovery is achieved through a set of actions to help an entity get through difficult times.
Recognize each operational function or department and its experts who specialize in specific areas.
Recovery of a critical or time-sensitive process requires resources. Following an incident that disrupts operations, resources will be needed to carry out recovery strategies and to restore normal operations. Resources can come from within the organization or community or be provided by third parties.
Resources are required to restore organizational operations following a disaster. Since all resources cannot be replaced immediately following a loss, managers should estimate the resources that will be needed in the hours, days, and weeks following an incident.
These resources include:
Organizations and communities should compile an inventory of hardware (e.g., servers, desktops, laptops, and wireless devices) and software applications. The plan should include a strategy to ensure that all critical information is backed up.
Using standardized hardware will help to replicate and reimage new hardware. Ensure that copies of program software are available to enable reinstallation on replacement equipment. Prioritize hardware and software restoration.
Documentation should include:
Recovery strategies require resources including people, facilities, equipment, materials, and information technology. An analysis of the resources required to execute recovery strategies should be conducted to identify gaps. For example, if a machine fails but other machines are readily available to make up lost production, then there is no resource gap. However, if all machines are lost due to a flood, and insufficient undamaged inventory is available to meet customer demand until production is restored, production might be made up by machines at another facility — whether owned or contracted.
Strategies may involve contracting with third parties, entering into partnership or reciprocal agreements, or displacing other activities within the organization or community. Individuals with in-depth knowledge of organizational functions and processes are in the best position to determine what will work. Possible alternatives should be explored and presented to management for approval and to decide how much to spend.
POSSIBLE RECOVERY STRATEGIES
Use other owned or controlled facilities performing similar work. Operations may be relocated to an alternate site — assuming both are not impacted by the same incident. This strategy also assumes that the surviving site has the resources and capacity to take on the work of the impacted site. Prioritizing production or service levels, providing additional staff and resources, and taking other action would be needed if capacity at the second site is inadequate.
Telecommuting is a strategy employed when staff can work from home through remote connectivity. It can be used in combination with other strategies to reduce alternate site requirements. This strategy requires ensuring telecommuters have a suitable environment in their home to work and are equipped with or have access to a computer with required applications and data, peripherals, and a secure broadband connection. In an emergency, space at another facility can be put to use.
Many vendors support business continuity and information technology recovery strategies. External suppliers can provide a full business environment, including office space and live data centers ready to be occupied. Other options include the provision of technology-equipped office trailers, replacement machinery, and other equipment. The availability and cost of these options can be affected when a disaster results in competition for these resources.
Cafeterias, conference rooms, and training rooms can be converted to office space. Equipping converted space with furnishings, equipment, power, connectivity, and other resources would be required to meet the needs of workers.
Partnership or reciprocal agreements can be arranged with other businesses or organizations that can support each other in the event of a disaster. Assuming space is available, issues such as the capacity and connectivity of telecommunications and information technology, protection of privacy and intellectual property, the impacts to each other’s operation, and allocation of expenses must be addressed. Agreements should be negotiated in writing and documented in the business continuity plan. A periodic review of the agreement is needed to determine if there is a change in the ability of each party to support the other.
The development of manual workarounds is a recovery strategy used when information technology resources are not available. Develop manual workarounds by outlining steps in the automated process and identifying intervention points. Creating a diagram of the process can help. Manual workarounds require manual labor, so you may need to reassign staff or bring in temporary assistance.
By identifying potential problems and creating a plan, you can minimize disruptions to your organization or community before they take place.
Essential to resilience management is to review — or create if needed — an emergency response plan that includes a risk assessment of potential emergency scenarios. An understanding of what can happen will enable you to determine resource requirements and to develop plans and procedures to prepare your organization.
Every emergency response plan should address the four main protective actions:
Emergency response teams are groups of people who prepare for and respond to emergency incidents such as natural disasters, security threats, public health crises, or other potential business disruptions.
Protective action procedures are actions taken to reduce or eliminate exposure to a hazard.
Protecting the safety of people and property is the primary goal of local emergency services (fire department, police department, emergency medical services). They are available to help in times of disaster or crisis.